{
  "schema": "p6-d.v1",
  "classification": "approved first-cutover security timing policy; no production issuer, lease controller, route, or serving authority is enabled",
  "revisions": {
    "nexuscrm": "e06339fa10d88ef0f832aef594fc365912e596a5",
    "contract": "c01105baf6345bad21045530994f8da15e9ff988",
    "contract_tag": "v0.1.10",
    "api_host": "77c66b28d48b4089682c918a2e82c226a27281eb",
    "api_host_tag": "v0.5.0",
    "exact_main_ci_run": 29225504045
  },
  "observed": {
    "protocol_max_delegation_lifetime_seconds": 600,
    "protocol_max_verifier_skew_seconds": 30,
    "runtime_attempt_cap_seconds": 2,
    "authoritative_admission_reads_per_call": 1
  },
  "decisions": {
    "delegation_lifetime": {
      "status": "APPROVED",
      "value": 60,
      "unit": "seconds",
      "owner": "Runtime Identity issuer",
      "meaning": "maximum production lifetime from iat to exp; the 10-minute contract value remains only a hard ceiling",
      "enforcement": "issuer rejects any requested lifetime above this value",
      "gate": "P7/P5 production issuer assembly and exact/one-over tests"
    },
    "verifier_clock_skew": {
      "status": "APPROVED",
      "value": 5,
      "unit": "seconds",
      "owner": "Runtime Identity key/verifier policy",
      "meaning": "whole-second allowance applied only to delegation iat/exp checks",
      "enforcement": "every production verifier is constructed with this value",
      "gate": "P7/P5 clock-health and exact-boundary tests"
    },
    "planned_key_overlap": {
      "status": "APPROVED",
      "value": 65,
      "unit": "seconds",
      "owner": "Runtime Identity key authority",
      "meaning": "old verification key remains overlap from signing cutover through production lifetime plus verifier skew",
      "enforcement": "two-phase rotation prepublishes and acknowledges the new key before signing cutover, then retires the old key at the overlap boundary",
      "gate": "P5 Runtime Identity key-provider assembly and rotation drill"
    },
    "emergency_key_overlap": {
      "status": "APPROVED",
      "value": 0,
      "unit": "seconds",
      "owner": "Runtime Identity key authority",
      "meaning": "a suspected-compromised key is retired immediately even though existing delegations fail",
      "enforcement": "emergency rotation bypasses planned overlap and advances authoritative key state",
      "gate": "P5 compromised-key drill"
    },
    "revocation_tombstone_tail": {
      "status": "APPROVED",
      "value": 5,
      "unit": "seconds",
      "owner": "Runtime Identity revocation authority",
      "meaning": "a delegation tombstone remains authoritative through exp plus configured verifier skew",
      "enforcement": "revocation expiry is derived from authenticated claims and cannot be shortened by a caller",
      "gate": "P5 production issuer/revocation wiring and exact-boundary test"
    },
    "security_lease_duration": {
      "status": "APPROVED",
      "value": 30,
      "unit": "seconds",
      "owner": "Runtime Identity/Security lease authority",
      "meaning": "maximum issued lease lifetime; it fences readiness and never authorizes cached stale serving",
      "enforcement": "authority-clock lease issuance rejects longer values",
      "gate": "P7 authority-clock renewal controller and expiry test"
    },
    "security_lease_renewal": {
      "status": "APPROVED",
      "value": 10,
      "unit": "seconds",
      "owner": "Runtime replica serving-state controller",
      "meaning": "target renewal interval; a failed refresh rejects no less than its own attempt and process eligibility remains bounded by the unexpired authority-issued lease",
      "enforcement": "controller refreshes explicitly, never extends a lease from the replica wall clock, and every request still performs its authoritative admission read",
      "gate": "P7 pause/partition/renewal matrix"
    },
    "max_security_staleness": {
      "status": "APPROVED",
      "value": 0,
      "unit": "seconds",
      "owner": "Runtime security admission",
      "meaning": "maximum intentional cached-authority age for an attempt whose admission begins after a security change commits",
      "enforcement": "every attempt performs the authoritative security read; a lease never substitutes for it",
      "gate": "P7 atomic serving view and P5 next-attempt revocation test"
    },
    "in_flight_authorization_window": {
      "status": "APPROVED",
      "value": 2,
      "unit": "seconds",
      "owner": "Runtime capability",
      "meaning": "trusted attempt-context cap for a call admitted before a security change commits; not a client response-delivery SLO",
      "enforcement": "the existing selected-root attempt deadline bounds Runtime execution while transport and route owners retain their own lifecycle",
      "gate": "P5 revocation-during-in-flight-attempt and route-deadline tests"
    },
    "lease_backed_stale_serving": {
      "status": "REJECTED",
      "value": 0,
      "unit": "enabled boolean",
      "owner": "Runtime security admission",
      "meaning": "the first production slice may not substitute an unexpired lease for the current per-call authoritative security read",
      "enforcement": "one admission snapshot per attempt before session and Records",
      "gate": "a future cached snapshot requires a new measured ADR and may not exceed MaxSecurityStaleness"
    }
  },
  "production_cutover_gates": [
    "P7: bind one authoritative security snapshot to one metadata serving view and preserve one read path",
    "P7: issue and renew leases from authority/database time; a replica clock may only shorten the remaining lease and verifier skew never extends it",
    "P5 Runtime Identity: prepublish and acknowledge a new verification key before signing cutover; retain the old key for exactly the planned overlap and retire compromised keys immediately",
    "P5: prove clock health, lease pause/partition recovery, normal and emergency rotation, revocation during an in-flight attempt, and zero stale admission of the next attempt"
  ]
}